Starstruk Logo MarkStarstruk

v4.12.4

honojs/honov4.12.4Mar 3, 2026by yusukebe

AI Summary

Security release fixing three vulnerabilities: SSE control field injection in Streaming Helper, cookie attribute injection in setCookie(), and middleware bypass in Serve Static middleware. Users of these components are strongly encouraged to upgrade.

Key Highlights

  • Fixed SSE Control Field Injection in streamSSE() - rejects CR/LF in event, id, retry
  • Fixed Cookie Attribute Injection in setCookie() - rejects ;, \r, \n in domain and path
  • Fixed Serve Static middleware bypass - inconsistent URL decoding issue
  • Fixed client route schema preservation in ApplyGlobalResponse
  • Fixed tryDecodeURI return type specification

New Features

  • Security fix: SSE Control Field Injection (GHSA-p6xx-57qc-3wxr)
  • Security fix: Cookie Attribute Injection (GHSA-5pq2-9x2x-5p6w)
  • Security fix: Serve Static Middleware Bypass (GHSA-q5qw-h33p-qvwr)

Full Release Notes

## Security fixes

This release includes fixes for the following security issues:

### SSE Control Field Injection

Affects: `streamSSE()` in Streaming Helper. Fixes injection of unintended SSE fields by rejecting CR/LF characters in `event`, `id`, and `retry`. https://github.com/honojs/hono/security/advisories/GHSA-p6xx-57qc-3wxr

### Cookie Attribute Injection in `setCookie()`

Affects: `setCookie()` from `hono/cookie`. Fixes cookie attribute manipulation by rejecting `;`, `\r`, and `\n` in `domain` and `path` options. https://github.com/honojs/hono/security/advisories/GHSA-5pq2-9x2x-5p6w

### Middleware Bypass in Serve Static

Affects: Serve Static middleware. Fixes inconsistent URL decoding that could allow protected static resources to be accessed without triggering route-based middleware. https://github.com/honojs/hono/security/advisories/GHSA-q5qw-h33p-qvwr

Users who uses Strreaming Helper, Cookie utility, and Serve Static are strongly encouraged to upgrade to this version.

---

## Other changes

* fix(client): preserve route schema in ApplyGlobalResponse by @agumy in https://github.com/honojs/hono/pull/4777
* fix(utils/url): specify the return type of `tryDecodeURI` by @yusukebe in https://github.com/honojs/hono/pull/4779

## New Contributors
* @agumy made their first contribution in https://github.com/honojs/hono/pull/4777

**Full Changelog**: https://github.com/honojs/hono/compare/v4.12.3...v4.12.4